Reboot Configuration

Your system has restarted multiple times, and you’d like to know what process or task triggered the reboots. Follow the steps below to determine the exact cause.

1. Check System Event Logs

Open the Windows Event Viewer and filter logs with the following Event IDs:

• 1074 — A process or user initiated a restart/shutdown.
• 1076 — Reason for unexpected shutdown/restart.
• 41 — System restarted without a clean shutdown (e.g., power failure or crash).

Look at the process in these events.

• If the process is dcmsghandler.exe → proceed to Step 2.
• If the process is dcondemand.exe → proceed to Step 3.
• If the process is something else → note it down and share with support.

2. If the Reboot Was Triggered by dcmsghandler.exe

This indicates the restart was initiated by the patch/deployment agent. Open the following logs:

• dcmsghandleraccess.log → shows when and how the reboot was triggered.
• dcconfigaccess.log → shows which task or deployment policy was running at that time.
• rbt.json → contains details of the latest deployment that triggered the reboot.

dcconfigaccess.log shows a task "8x8 need to delete" that ran at 11:41:13  
dcmsghandleraccess.log shows IMMEDIATE_REBOOT triggered at 11:41:21  

This means the reboot was linked to that deployment task.

If you are on build 2516 or later, you can also check dcrebootaccess.log; which provides detailed information about the reboot, including:

• Collection name (e.g., “Windows OS Patch Deployment”)
• Deployment policy ID
• Whether the reboot was postponed or immediate

25-04-15,1,67740000002449363,Windows OS Patch Deployment,67740000002449337,....,PROMPT_REBOOT

This indicates the reboot came from the “Windows OS Patch Deployment” task.

3. If the Reboot Was Triggered by dcondemand.exe

This means a remote shutdown task was initiated by an administrator.

• Open ondemandrequest.log
• Search for the keyword remoteshutdowntaskdetails
• This will show the task ID, shutdown message, and whether the action was postpone-able.

{
  "shutdown_message": "Your computer will be Shutdown/Restart by the Administrator...",
  "task_id": 52721000000444001
}

This above message confirms the restart was triggered remotely by an administrator request.

4. If the Process Is Different

If the reboot is not caused by the above two executables, capture a screenshot of the Event Log entry and share it with support. This will help identify whether another process or system failure was responsible.